CLF-C02 Security and Compliance Practice Question
A company needs to ensure that none of their AWS accounts allow resources to be deployed outside of the us-east-1 and eu-west-1 regions for data sovereignty. Which control achieves this most effectively?
⚠ Common exam trap
Test-takers frequently confuse detective controls (AWS Config) with preventive controls (SCPs), or assume IAM permission boundaries can enforce region restrictions globally, when in fact SCPs are the only mechanism that applies to all principals in an account, including the root user.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply an SCP in AWS Organizations that denies resource creation outside approved regions
B is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny resource creation in non-approved regions across all member accounts. By applying an SCP with a condition that denies actions unless the `aws:RequestedRegion` is `us-east-1` or `eu-west-1`, you enforce data sovereignty at the organization level, preventing any account from deploying resources outside those regions regardless of individual account permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure AWS Config rules in each account to detect out-of-region deployments
Why it's wrong here
AWS Config is a detective control: it evaluates and records resource configurations only after the resource has already been created. While a Config rule can flag a resource launched in a non-approved region, the deployment violation has already occurred by the time the rule triggers. Automated remediation could subsequently delete or stop the resource, but there is an inherent delay and the mechanism cannot intercept the original create API request. This is fundamentally different from an SCP, which denies the API call before any resource is provisioned.
- ✓
Apply an SCP in AWS Organizations that denies resource creation outside approved regions
Why this is correct
An SCP attached to the root or an organizational unit in AWS Organizations centrally evaluates requests from every IAM principal in member accounts and can explicitly deny actions when the `aws:RequestedRegion` condition does not match an approved list. Because SCPs act at the organization boundary, they apply uniformly to all affected accounts without per-principal setup and cannot be overridden by IAM identity or resource policies. A Deny statement using `aws:RequestedRegion` blocks create operations (like `ec2:RunInstances` or `rds:CreateDBInstance`) pre-emptively, ensuring no resource is ever provisioned in a disallowed region.
- ✗
Train developers to only deploy in approved regions
Why it's wrong here
Training and developer awareness campaigns address human behavior but do not constitute a technical enforcement mechanism; they cannot stop accidental API calls, misconfigured scripts, or intentional actions that specify an unintended region. A policy-based guardrail is required to provide consistent, mandatory compliance regardless of user intent or attention. While education is valuable for improving organizational culture, it is not an automated control and is therefore insufficient for strict governance. This option fails because it leaves the enforcement gap wide open and relies entirely on human discipline rather than infrastructure enforcement.
- ✗
Enable IAM permission boundaries restricting regions in each account
Why it's wrong here
IAM permission boundaries cap a principal's maximum permissions, but each boundary must be attached to every individual IAM user or role in every account, making it operationally impractical for organization-wide enforcement. A permission boundary is also not inherited from an organization-level policy, so it cannot provide centralized governance. Additionally, a boundary limits effective permissions but does not itself deny an API call unless it includes a specific condition, and each principal still requires separate boundary attachment. Therefore, this approach does not meet the requirement for a scalable, proactive control across all accounts.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.